I do not use facebook much, but I tend to notice things when I do. For example, the chat feature had been enabled on my behalf. I do not want people to see that I am "currently online" and by now I have disabled that feature more than once, since it somehow magically gets reset to "enabled"

Then there is this tendency to allow indirect access. See here [growmap.com]. Basically, applications may access your information by your friend's permission instead of yours.

Finally, see a quote from this article [readwriteweb.com]. It is from 2009, but I think it is very representative of Facebook attitude. Most of the time you _can_ keep your setting private, but _only_ if you are actively tracking how facebook re-enabled access by default and proactively re-disabling that in settings.

Facebook announced this morning that its 350 million users will be prompted to make their status messages and shared content publicly visible to the world at large and search engines. It's a move we expected but the language used in the announcement is near Orwellian. The company says the move is all about helping users protect their privacy and connect with other people, but the new default option is to change from "old settings" to becoming visible to "everyone."